What causes "TLS configuration '' was specified, but it does not exist." in quarkusio/quarkus?

Check application config for a matching quarkus.tls. .key-store/trust-store definition whose exactly equals the tls-configuration-name value

quarkusio/quarkus · critical · ConfigurationException

TLS configuration '' was specified, but it does not exist.

Error message

TLS configuration '' was specified, but it does not exist.

What it means

At build/static-init time the SmallRye GraphQL client recorder resolves the TLS configuration named via quarkus.smallrye-graphql-client.<client>.tls-configuration-name through the TLS registry. If TlsConfiguration.from(registry, name) finds no configuration registered under that name, the recorder throws this ConfigurationException, failing application startup. The empty name in the message is the unresolved placeholder for the configured value.

Source

Thrown at extensions/smallrye-graphql-client/runtime/src/main/java/io/quarkus/smallrye/graphql/client/runtime/SmallRyeGraphQLClientRecorder.java:250

        // the client extension doesn't have dependencies on neither the server extension nor quarkus-vertx-http, so guessing
        // is somewhat limited
        return "http://localhost:" + config.getOptionalValue("quarkus.http.test-port", int.class).orElse(8081) + "/graphql";
    }

    public RuntimeValue<ClientModels> getRuntimeClientModel(ClientModels clientModel) {
        return new RuntimeValue<>(clientModel);
    }

    private Optional<TlsConfiguration> resolveTlsConfigurationForRegistry(GraphQLClientConfig quarkusConfig) {
        if (Arc.container() != null) {
            TlsConfigurationRegistry tlsConfigurationRegistry = Arc.container().select(TlsConfigurationRegistry.class).orNull();
            if (tlsConfigurationRegistry != null) {
                if (quarkusConfig.tlsConfigurationName().isPresent()) {
                    // explicit TLS config
                    Optional<TlsConfiguration> namedConfig = TlsConfiguration.from(tlsConfigurationRegistry,
                            quarkusConfig.tlsConfigurationName());
                    if (namedConfig.isEmpty()) {
                        throw new ConfigurationException("TLS configuration '" + quarkusConfig.tlsConfigurationName().get()
                                + "' was specified, but it does not exist.");
                    }
                    return namedConfig;
                } else {
                    // no explicit TLS config
                    return tlsConfigurationRegistry.getDefault();
                }
            } else {
                if (quarkusConfig.tlsConfigurationName().isPresent()) {
                    throw new ConfigurationException("TLS configuration '" + quarkusConfig.tlsConfigurationName().get()
                            + "' was specified, but no TLS configuration registry could be found.");
                }
            }
        }
        return Optional.empty();
    }

    private Optional<ProxyConfiguration> resolveProxyConfiguration(GraphQLClientConfig clientConfig) {

View on GitHub (pinned to e1c734241f)

Solutions

Check application config for a matching quarkus.tls.<name>.key-store/trust-store definition whose <name> exactly equals the tls-configuration-name value
Fix typos or case mismatches in the tls-configuration-name value
Remove quarkus.smallrye-graphql-client.<client>.tls-configuration-name to use the default TLS configuration (quarkus.tls.*)
Define the named TLS bucket, e.g. quarkus.tls.my-tls.key-store.path=...

Example fix

// before (application.properties)
quarkus.smallrye-graphql-client.my-client.tls-configuration-name=prod-tls
// no quarkus.tls.prod-tls.* defined

// after
quarkus.tls.prod-tls.key-store.path=certs/keystore.p12
quarkus.tls.prod-tls.key-store.password=secret
quarkus.smallrye-graphql-client.my-client.tls-configuration-name=prod-tls

Defensive patterns

Strategy: validation

Validate before calling

// Fail fast at startup if the named TLS bucket is missing
String name = ConfigProvider.getConfig().getValue("quarkus.smallrye-graphql-client.my-client.tls-configuration-name", String.class);
if (name != null && !ConfigUtils.isPropertyPresent("quarkus.tls." + name + ".key-store.path")
        && !ConfigUtils.isPropertyPresent("quarkus.tls." + name + ".trust-store.path")) {
    throw new IllegalStateException("TLS bucket quarkus.tls." + name + " is not defined");
}

Try / catch

try {
    client.call();
} catch (ConfigurationException e) {
    if (e.getMessage().contains("TLS configuration")) {
        throw new IllegalStateException("Check quarkus.tls.<name>.* buckets vs tls-configuration-name", e);
    }
    throw e;
}

Prevention

Keep TLS bucket names in one constants/enums file referenced by all clients
Validate TLS config in a startup @Observes StartupEvent or a test
Use the default quarkus.tls.* bucket unless multiple configs are truly needed
Grep application.properties for tls-configuration-name after refactoring TLS config

When it happens

Trigger: quarkus.smallrye-graphql-client.<client>.tls-configuration-name (or a @GraphQLClientApi config) is set to a name that has no matching quarkus.tls.<name>.* TLS bucket definition in the application configuration.

Common situations: Typo in the tls-configuration-name value; TLS bucket defined under the wrong config root; config not loaded (wrong profile, misnamed application.properties); renaming a TLS bucket without updating referencing clients; copying config from another project without the quarkus.tls.* section.

Understand the failure class

SSL/TLS and certificate errors — how TLS handshakes and certificate validation fail.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/2b120f8af7e04527. Report an issue: GitHub.